ledgerl-ogin[.]pages[.]dev

Analysis of the domain ledgerl-ogin.pages.dev confirms its classification as an active credential phishing site targeting Ledger, a hardware wallet provider. The domain was registered on April 19, 2026, through Cloudflare, Inc., and is currently resolving to the IP address 172.66.44.130, located in Canada. Infrastructure analysis reveals the use of Cloudflare nameservers (ainsley.ns.cloudflare.com and salvador.ns.cloudflare.com) and hosting services, which are commonly leveraged to obscure the true origin of malicious activity. The site returns an HTTP 200 status, indicating it is operational, and employs technologies such as HSTS, Google Analytics, and HTTP/3, which may be used to enhance legitimacy or track victim interactions. The page title, 'Ledger® : Login | Getting Started™,' explicitly impersonates Ledger, aligning with the known scam type of credential phishing. The domain is flagged by at least one security blocklist and has been assigned a trust score of 0/100 by Gridinsoft, further supporting its malicious classification. While three of 94 security vendors on VirusTotal have detected this domain as malicious, the absence of broader detection does not diminish the confirmed threat. The SSL certificate is issued by Google Trust Services (WE1), which, while legitimate, does not validate the site's intent. Defenders should treat this domain as high-risk and prioritize blocking or monitoring access to it. Given its active status and confirmed impersonation of a cryptocurrency security brand, users should be alerted to the risk of credential theft or financial loss. No evidence suggests the site has been taken down, and its infrastructure remains intact as of July 12, 2026. Further investigation into associated IP ranges, certificate chains, or linked domains may uncover additional threats within the same campaign.